TCP SYN (p0f)

6:45+19:0:1432:mss*45,10:mss,sok,ts,nop,ws:flow:0

first seen 2026-07-01 15:07 · last seen 2026-07-01 16:30 · JSON

Decomposed attributes

IP version	`6`
Initial TTL	`45+19`
Options length	`0`
MSS	`1432`
Window size	`mss*45`
Window scale	`10`
Options layout	`mss,sok,ts,nop,ws`
Quirks	`flow`
Payload class	`0`

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprint	co-occurrences
`t13d1514h2_8daaf6152771_53a6d0ab1c42`	1
`t13d1515h2_8daaf6152771_a54fffd0eb61`	1
`t13d3013h2_1d37bd780c83_8537cf56674e`	1

HTTP request (JA4H)

fingerprint	co-occurrences
`ge20nn030000_e057572924c3_000000000000_000000000000`	1
`ge20nr12enus_a72b71f519fc_000000000000_000000000000`	1
`ge20nr11enus_187a9385d229_000000000000_000000000000`	1

HTTP/2 frames (Akamai)

fingerprint	co-occurrences
`1:65536;2:0;4:131072;5:16384\|12517377\|3:0:0:42\|m,p,a,s` Match?Exact match in Thumbprint's published controlled catalog captures: firefox 154.0, firefox 152.0.5, firefox 152.0.1, +3 more.The fingerprint page shows the full measured match list. More on the catalog.	1
`1:65536;2:0;4:131072;5:16384\|12517377\|3:0:0:22\|m,p,a,s` Match?Exact match in Thumbprint's published controlled catalog captures: firefox 153.0, firefox 153.0.3, firefox 154.0, +25 more.The fingerprint page shows the full measured match list. More on the catalog.	1
`3:100;4:65536;2:0\|1048510465\|0\|m,s,a,p` Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.13.0, curl 8.18.0, curl 8.21.0, +7 more.The fingerprint page shows the full measured match list. More on the catalog.	1

TCP SYN (JA4T)

fingerprint	co-occurrences
`64440_2-4-8-1-3_1432_10`	3

User-Agent

fingerprint	co-occurrences
`Mozilla/5.0 (X11; Linux x86_64; rv:151.0) Gecko/20100101 Firefox/151.0`	2
`Mozilla/5.0 (compatible; clatter.el)`	1

Country

fingerprint	co-occurrences
`DE` · Germany	2
`JO` · Jordan	1

Network (ASN)

fingerprint	co-occurrences
`AS8881` · 1&1 Versatel GmbH	2
`AS8376` · Jordan Data Communications Company LLC	1

fingerprint	co-occurrences
`1:65536;2:0;4:131072;5:16384\|12517377\|3:0:0:42\|m,p,a,s` Match?Exact match in Thumbprint's published controlled catalog captures: firefox 154.0, firefox 152.0.5, firefox 152.0.1, +3 more.The fingerprint page shows the full measured match list. More on the catalog.	1
`1:65536;2:0;4:131072;5:16384\|12517377\|3:0:0:22\|m,p,a,s` Match?Exact match in Thumbprint's published controlled catalog captures: firefox 153.0, firefox 153.0.3, firefox 154.0, +25 more.The fingerprint page shows the full measured match list. More on the catalog.	1
`3:100;4:65536;2:0\|1048510465\|0\|m,s,a,p` Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.13.0, curl 8.18.0, curl 8.21.0, +7 more.The fingerprint page shows the full measured match list. More on the catalog.	1